\n * Linux BPF filters will return {@code EACCES} (Access Denied) for the following system calls:\n *
\n *
{@code execve}
\n *
{@code fork}
\n *
{@code vfork}
\n *
{@code execveat}
\n *
\n * @see \n * * http://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt\n */\n @Override\n public void tryInstallExecSandbox() {\n // first be defensive: we can give nice errors this way, at the very least.\n // also, some of these security features get backported to old versions, checking kernel version here is a big no-no!\n String archId = System.getProperty(\"os.arch\");\n final Arch arch = ARCHITECTURES.get(archId);\n if (arch == null) {\n throw new UnsupportedOperationException(\"seccomp unavailable: '\" + archId + \"' architecture unsupported\");\n }\n\n // try to check system calls really are who they claim\n // you never know (e.g. https://chromium.googlesource.com/chromium/src.git/+/master/sandbox/linux/seccomp-bpf/sandbox_bpf.cc#57)\n final int bogusArg = 0xf7a46a5c;\n\n // test seccomp(BOGUS)\n long ret = linuxLibc.syscall(arch.seccomp, bogusArg, 0, null);\n if (ret != -1) {\n throw new UnsupportedOperationException(\"seccomp unavailable: seccomp(BOGUS_OPERATION) returned \" + ret);\n } else {\n int errno = libc.errno();\n switch (errno) {\n case ENOSYS:\n break; // ok\n case EINVAL:\n break; // ok\n default:","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/native/src/main/java/org/elasticsearch/nativeaccess/LinuxNativeAccess.java#L154-L190","documentation":"tryInstallExecSandbox reads os.arch and looks it up in the ARCHITECTURES map, which only contains amd64 and aarch64. If the running JVM reports any other architecture, seccomp-based exec filtering cannot be installed and the method bails out immediately with this UnsupportedOperationException. The check is on architecture, not kernel version, because features can be backported.","triggerScenarios":"Invoking LinuxNativeAccess.tryInstallExecSandbox() on a JVM whose System.getProperty(\"os.arch\") is neither amd64 nor aarch64 (e.g. x86, arm, ppc64le, s390x, riscv64). This is called during Elasticsearch bootstrap on Linux when the exec sandbox is enabled.","commonSituations":"Running Elasticsearch on older/unsupported CPU architectures. Using a 32-bit JVM on a 64-bit host where os.arch reports 'x86' or 'arm'. Containers on uncommon architectures. The message echoes the exact os.arch value for diagnosis.","solutions":["Run Elasticsearch on an amd64 (x86-64) or aarch64 (ARM64) host.","If on 64-bit hardware, ensure a 64-bit JVM is used so os.arch reports amd64/aarch64 rather than a 32-bit value.","If the architecture genuinely cannot change, accept that the exec sandbox is unavailable; Elasticsearch will continue without it (the throw is logged, not fatal to startup unless the sandbox is hard-required)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"String arch = System.getProperty(\"os.arch\");\nif (!\"amd64\".equals(arch) && !\"aarch64\".equals(arch)) {\n // exec sandbox not available; decide whether to proceed without it\n logger.warn(\"Exec sandbox unsupported on architecture {}\", arch);\n}","typeGuard":"static boolean isSeccompSupportedArch() {\n String arch = System.getProperty(\"os.arch\");\n return \"amd64\".equals(arch) || \"aarch64\".equals(arch);\n}","tryCatchPattern":"try {\n nativeAccess.tryInstallExecSandbox();\n} catch (UnsupportedOperationException e) {\n // sandbox optional; log and continue, or fail hard if policy requires it\n logger.warn(\"Could not install exec sandbox: {}\", e.getMessage());\n}","preventionTips":["Deploy Elasticsearch on amd64 or aarch64 hosts only if the exec sandbox is required.","Use a 64-bit JVM so os.arch reports amd64/aarch64, not a 32-bit value.","Gate sandbox installation on a supported-architecture check before calling tryInstallExecSandbox."],"tags":["seccomp","security","architecture","native","linux","bootstrap"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}